CVE-2026-45829

CRITICAL

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malic...

Affects 0 products across 2 vendors.

CVSS 3.110.0
CVSS v410.0
EPSS1.0%
Percentile63th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

CWE-502: Deserialization of Untrusted Data

Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94
CAPEC-586 Object Injection
via CWE-502

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A low severity vulnerability affects Project systems (CVE-2026-45829). A proof-of-concept has been published. Review vendor advisories and apply patches during the next maintenance window.

BSID: BS-2026-GLOBAL-270992-I • Model: rule-based-v1 • Confidence: LOW

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-45829?
A low severity vulnerability affects Project systems (CVE-2026-45829). A proof-of-concept has been published. Review vendor advisories and apply patches during the next maintenance window.
What is the CVSS score for CVE-2026-45829?
CVE-2026-45829 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.0%.
Is CVE-2026-45829 actively exploited?
No confirmed active exploitation of CVE-2026-45829 as of 2026-09-25.
How do I remediate CVE-2026-45829?
Priority: MONITOR.
What systems are affected by CVE-2026-45829?
CVE-2026-45829 affects Project; Python.
Vulnerability Details
CVE IDCVE-2026-45829
BSIDBS-2026-GLOBAL-270992-I BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2026-05-18
Last Modified2026-07-15
ICS Relevance15%
Weakness (CWE)
Code InjectionDeserialization of Untrusted Data
SourceNVD
Official Description

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. CVSS vector: Not available.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Project — —
Python — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 150 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceLOW
Enriched At2026-05-24
SHA-512 Audit Hash50b9ab499b5daad1376a625cd3cc19a98030c3c13f33b213dae98e8d5a66d6035d9dc45459dcfcdc2ce6ed1c75f5e729087acd50ab691c009a1ec4b5da78f90c
Related CVEs affecting Project
CVE-2025-59823 9.9 Project Gardener implements the automated management and operation of Kuberne... CVE-2025-47282 9.9 Gardener External DNS Management is an environment to manage external DNS ent... CVE-2026-22797 9.9 An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 bef... CVE-2025-0987 9.9 Authorization Bypass Through User-Controlled Key vulnerability in CB Project ... CVE-2024-41110 9.9 Moby is an open-source project created by Docker for software containerizatio...
View all Project CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →